> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Crowdin

> Connect your Crowdin Enterprise organization to Oleria to discover members, teams, roles, projects, non-human identities, and security-log activity across your localization platform.

Connect Crowdin Enterprise to Oleria to see who can reach your localization projects and how. Oleria reads members, teams, organization and project roles, projects and project groups, installed Crowdin Apps, the third-party secrets Crowdin stores, and the organization security log. You can then find dormant or over-privileged access and act on it directly from Oleria.

> [!NOTE]
>
> This integration supports **Crowdin Enterprise** only. crowdin.com accounts that aren't part of an Enterprise organization can't be connected. Each integration connects one Crowdin Enterprise organization. If you have more than one, add an integration for each. See [Multi-instance support](/integrations/overview.md#multi-instance-support).

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Crowdin Enterprise organization:

* **Accounts** - every organization member, whether active, blocked, or invited but not yet joined. Members of linked vendor and client organizations appear as external users. For each member, Oleria shows:
  * **Name, username, and email.**
  * **Status** - blocked members show as disabled. Invited members who haven't accepted show as enabled but inactive.
  * **Account role** - **Admin**, **Manager**, **Vendor**, **Client**, or **Member**. Admins are marked as administrators.
  * **MFA** - from the member's two-factor authentication and device verification settings, and your organization's two-factor policy.
  * **Single sign-on (SSO) and login methods** - the methods the member signs in with, such as password, SAML or OpenID Connect, social sign-in, or passkey.
  * **Last seen** - the member's last activity in Crowdin, used for dormant account detection.
  * **Last password change** - the most recent password change or password set event in the security log.
  * **API access** - whether the member has any personal access tokens.

* **Teams** - every team and its members.

* **Roles**:
  * **Organization roles** - **Admin**, **Manager**, **Vendor**, and **Client**. Admins have full access to every project and group.
  * **Group Manager** - one per project group, held by the group's managers. It grants access to the group and every subgroup and project in it.
  * **Project roles** - **Project Manager**, **Developer**, **Proofreader**, **Translator**, and **Language Coordinator**, one set per project. Project roles are held by members and by teams added to the project. For language roles, the languages they cover are shown on the access entry.

* **Resources** - every project and project group, with the groups nested as they are in Crowdin. A project's creator is shown as its owner.

* **Public access** - an **Anyone (public projects)** account stands for anyone outside your organization. It has translate access to projects with crowdsourcing turned on, and read access to projects with public downloads turned on.

* **Non-human identities (NHIs) and credentials:**

  | Identity | Shown as |
  | :- | :- |
  | Installed Crowdin Apps | Application, with its scopes, the projects it can reach, and the member who installed it. |
  | Crowdin App agent users | Service account, linked to the app that acts as it. |
  | AI providers that use your own API key | Secret, with a stored credential. Oleria never reads the key. |
  | Machine translation engines that use your own API key | Secret, with a stored credential. Crowdin Translate, which uses Crowdin's own credentials, isn't shown. |
  | Organization and project webhooks with custom headers | Secret, with a stored credential and the webhook's target host. Oleria keeps only header names, never their values. |

* **Activity** - events from the organization security log, attributed to the member who performed them: sign-ins, password and email changes, two-factor and SSO changes, personal access tokens issued and revoked, sessions revoked, members registered, blocked, unblocked, and removed, apps connected and disconnected, team membership changes, admin and group manager grants, and changes to authentication and organization settings. Other events keep their Crowdin event name.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview.md#sync-model).

> [!NOTE]
>
> Crowdin has no AI agent objects, so none appear. A Crowdin App's agent user is a bot account that the app acts as, and is shown as a service account.

## Prerequisites

* A **Crowdin Enterprise** organization. Teams and SAML single sign-on are available on the **Business** plan or higher. If your plan restricts some data, Oleria skips teams, team project roles, and the organization's sign-in and two-factor settings, and syncs everything else.
* A Crowdin Enterprise organization **Owner** or **Admin** to create the personal access tokens. Oleria refuses a token whose user isn't an Owner or Admin: for other users, Crowdin hides member emails, two-factor authentication, sign-in methods, token counts, and other members' security-log events.
* Admin access on the Oleria platform to add a new integration.

> [!NOTE]
>
> Create the tokens from a dedicated admin account that isn't tied to an employee, such as `oleria-governance`, so the integration keeps working if that person leaves or loses admin rights. Oleria also refuses to block or delete the token's own user, or to remove its roles, team membership, or project access, so a dedicated account can't be locked out from Oleria by mistake.

## Create personal access tokens in Crowdin

Oleria uses a read-only personal access token for discovery. To run [remediation actions](#remediation-actions), you can add a second token with read and write access. Keeping them separate means the token used on every sync can't change anything in Crowdin.

> [!NOTE]
>
> The exact location of these settings can change over time. If the steps below don't match what you see, refer to Crowdin's [personal access tokens](https://support.crowdin.com/enterprise/personal-access-tokens/) and [scopes](https://support.crowdin.com/enterprise/understanding-scopes/) documentation.

**1. Open the access token settings**

Sign in to your Crowdin Enterprise organization, `https://<organization>.crowdin.com`, as the dedicated Owner or Admin account. Select your profile picture in the upper-right corner, select **Account Settings**, and open **Access tokens** (shown as **API** in some versions of Crowdin). Select **New Token**.

**2. Create the read-only token**

Enter a name, such as `Oleria (read)`, and choose an expiration date. Select these scopes, each with **Read only** access:

| Scope | Key | Used for |
| :- | :- | :- |
| Users | `user` | Members, their roles, MFA, login methods, and API access |
| Organization | `organization` | The organization and its authentication settings |
| Teams | `team` | Teams and their members |
| Groups | `group` | Project groups and group managers |
| Projects (Settings) | `project.settings` | Projects |
| Members and teams | `project.member` | Project members and teams, and their project roles |
| Webhooks (project) | `project.webhook` | Project webhooks |
| Webhooks (organization) | `webhook` | Organization webhooks |
| Applications | `application.installation` | Installed Crowdin Apps and their agent users |
| AI Providers | `ai.provider` | AI providers |
| Machine translation engines | `mt` | Machine translation engines |
| Security logs | `security-log` | Activity and last password change |

Leave **Granular access** off. With granular access on, the token reaches only the projects and groups you select, and the rest of your organization doesn't appear in Oleria.

Select **Create**, then copy the token. Crowdin shows it only once.

**3. Create the read and write token (optional)**

To let Oleria run remediation actions, select **New Token** again and create a token such as `Oleria (write)`, with **Granular access** off. Select these scopes with **Read and Write** access:

| Scope | Key | Used for |
| :- | :- | :- |
| Users | `user` | Block, unblock, invite, and delete users; grant and remove Admin; block app agent users |
| Teams | `team` | Add and remove team members; create teams |
| Groups | `group` | Grant and remove Group Manager |
| Members and teams | `project.member` | Grant and remove project roles; revoke project access |
| Applications | `application.installation` | Uninstall Crowdin Apps |
| AI Providers | `ai.provider` | Disable AI providers |
| Machine translation engines | `mt` | Disable machine translation engines |
| Webhooks (organization) | `webhook` | Disable organization webhooks |
| Webhooks (project) | `project.webhook` | Disable project webhooks |

Select **Create**, then copy the token.

If you don't add this token, Oleria runs actions with the read-only token, and they fail with a missing-scope error.

> [!WARNING]
>
> Treat both tokens like passwords. A token acts with the permissions of the Owner or Admin who created it, limited to its scopes.

> [!NOTE]
>
> Crowdin tokens don't expire by default, and your organization may set a maximum token lifetime. If you set an expiration date, add a reminder to create a new token and update the integration before it expires. When a token expires, the integration stops syncing, or actions stop working, until you update it.

## Connect Crowdin to Oleria

**1. Find your organization domain**

Your organization domain is the `<organization>` part of your Crowdin Enterprise address, `https://<organization>.crowdin.com`. For example, for `https://acme.crowdin.com`, enter `acme`. You can also paste the full address. Oleria keeps only the organization part.

**2. Open the integration**

Go to your Oleria workspace, select **Integrations**, select the **Available** tab, and search for **Crowdin**.

**3. Complete the connection form**

Select the **Crowdin** card and fill in the connection form:

| Field | Notes |
| :- | :- |
| **Organization domain** | Required. Your organization domain. You can't change it after the integration is created. To connect a different organization, add a new integration. |
| **Personal access token (read)** | Required. The read-only token. |
| **Personal access token (read and write, for remediation)** | Optional. The read and write token, for remediation actions. |

**4. Authenticate**

Select **Authenticate**. Before saving the integration, Oleria checks that each token is valid, belongs to this organization, and belongs to an organization Owner or Admin. Oleria also checks that the read-only token has every scope it needs. The read and write token's scopes are checked when an action runs.

If **Authenticate** fails, the message says what's wrong:

* **Crowdin rejected ... (401)** - the token is invalid or has expired. Create a new token.
* **... belongs to another Crowdin organization** - the token was created in a different organization. Sign in to `https://<organization>.crowdin.com` and create the token there.
* **The user of ... is not an organization Owner or Admin** - create the token as an organization Owner or Admin.
* **The read token lacks these Crowdin scopes (add them with Read only access): ...** - edit the read-only token in Crowdin and add the listed scopes with **Read only** access, or create a new token with every scope in the table above.

When you edit the integration, leave a token field blank to keep the stored token.

## Verify the integration

Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, review the discovered accounts, teams, roles, projects, NHIs, and activity in your Oleria workspace.

If your Crowdin plan doesn't include some data, such as teams, Oleria skips only that data and syncs everything else. If something you expect is missing, check that the read-only token has every scope in the table above.

## Remediation actions

Oleria can take these actions in Crowdin. Each action needs the read and write token, created by an organization Owner or Admin, with the scopes listed above.

| Action | What it does | Reversible? |
| :- | :- | :- |
| Disable user | Blocks the member. | Yes - reversed by unblocking the member. |
| Enable user | Unblocks the member. | Yes - reversed by blocking the member again. Doesn't apply to invited members who haven't joined. |
| Add user to team | Adds the member to a team. | Yes - reversed by removing the member from the team. |
| Remove user from team | Removes the member from a team. | Yes - reversed by adding the member back. |
| Add role | Grants **Admin**, **Group Manager** on a project group, or **Project Manager** or **Developer** on a project. | Yes - reversed by removing the role. |
| Remove role | Removes **Admin**, **Group Manager** on a project group, or one project role. If it's the member's last role on the project, the member is removed from the project. | Yes - the member's previous project roles and permissions are restored. |
| Revoke project access | Removes the member's direct project roles. If the member's access comes only from a team or from **Group Manager** on the project's group, the action succeeds and changes nothing. | Yes - reversed by adding the member back with their previous roles. For a member whose direct access was **Project Manager** or **Developer** plus language roles, undo restores only **Project Manager** or **Developer** and lists the language roles to grant again in Crowdin. |
| Delete user | Removes the member from the organization. | No - invite the user again. A new invitation creates a new member. |
| Create user | Invites a new member by email. The member shows as invited until they accept. | Yes, while the invitation is still pending. After the member accepts, delete the user in Crowdin to undo it. |
| Create team | Creates a new team. If a team with the same name exists, nothing changes. | Yes - Oleria deletes the team it created. |
| Disable NHI | Depends on the NHI: uninstalls a Crowdin App, blocks a Crowdin App agent user, or turns off an AI provider, machine translation engine, or webhook. | Yes, except uninstalling a Crowdin App, which removes the app's settings and data. Reinstall the app in Crowdin if needed. |

A few safeguards apply to every action:

* Oleria won't block or delete the token's own user, or remove its roles, team membership, or project access. Doing so would disconnect the integration.
* Oleria won't delete an Admin unless at least one other active (not blocked) Admin remains. You can delete a blocked Admin while another active Admin remains. Crowdin refuses changes to the organization Owner.
* Oleria won't uninstall a Crowdin App that Crowdin installed itself.
* Access a member gets from a team or from **Group Manager** on the project's group stays in place when you revoke their project access. Remove them from the team, or remove their **Group Manager** role, instead.
* If a member already has the state an action asks for, the action succeeds and changes nothing.

## Known limitations

* **Personal access tokens and OAuth app authorizations aren't inventoried.** Crowdin has no API to list or revoke them. Oleria shows whether a member has API access, and token issue and revoke events appear as activity. To review or revoke tokens, an Admin can open **Organization Settings > User access tokens** in Crowdin, which lists every member's tokens with their last-used and expiry dates. Manage OAuth apps under **Organization Settings > OAuth apps**.
* **Some security settings are available only in the Crowdin UI.** SAML configuration, **Enforce SAML**, IP allowlists, session settings, and the organization API log aren't available through the API. Changes to these settings appear as security-log activity, and each member's SSO status is inferred from their login methods.
* **Failed sign-ins aren't recorded.** Crowdin's security log records successful sign-ins only. Project permission changes and content access aren't in the log either.
* **No custom roles.** Crowdin has fixed roles only, and teams can't be nested.
* **The organization Owner is shown as an Admin.** Crowdin's API doesn't tell the Owner apart from other Admins. Workspace Managers aren't shown, because the API has no field for them.
* **Language roles can't be granted from Oleria.** **Translator**, **Proofreader**, and **Language Coordinator** need a language selection that the action doesn't carry, so grant them in Crowdin. Oleria also refuses to grant **Developer** to a member who holds language roles on the same project, because Crowdin would replace those roles. For a member who holds **Project Manager** or **Developer** access together with any language role on the same project, Oleria refuses to add or remove project roles before anything changes. Manage that member's roles in Crowdin. You can remove a language role from Oleria for any other member. Removing **Developer** from a **Project Manager** isn't supported, because developer access is part of that role. Remove **Project Manager** instead.
* **Team and group access to a project can't be removed from Oleria.** Revoking project access removes only a member's direct project roles. Remove the member from the team or remove their **Group Manager** role, or remove the team from the project in Crowdin.
* **Organization roles other than Admin can't be changed.** **Manager**, **Vendor**, and **Client** follow from project and group grants, or from the linked vendor or client organization.
* **Some data depends on your plan and settings.** Teams and SAML need the Business plan or higher. When your plan restricts data, Oleria skips teams, team project roles, and the organization's sign-in and two-factor settings, and syncs everything else. Group managers appear only when your organization uses them.
* **Crowdin Apps, agent users, and webhooks have no last-used date.** Crowdin doesn't report when they were last used.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.